Is Long Compound Entertainment safe?
We analyzed Long Compound Entertainment version 1.0.0's actual code and gave it a 64/100 trust score. This extension has broad automatic page-reading…
Bottom line
This extension has broad automatic page-reading access but shows no evidence of collecting information or abusing that access.
What it can access
The extension runs automatically on every website and reads visible page text across those pages.[Q1][Q2] This may include messages, documents, or account-related text displayed on a page, although passwords and typed form values are not specifically read.[Q3]
Security weaknesses
Automatically scanning all pages creates a broad privacy exposure if the extension is later compromised or expanded.[Q2][Q8] The packaged behavior shows no network channel, privileged browser-data access, or remote command mechanism.[Q6][Q16]
Signs of misuse
There is no evidence that the extension sends page information elsewhere or tracks browsing activity.[Q6][Q12] Its packaged rules are fixed locally, with no remote command channel or downloaded instructions.[Q7][Q16]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It runs automatically on all URLs and can read and edit page page content.
Declares an all-URLs content script plus activeTab and scripting permissions. — manifest.json:7-25
Which websites can it run on, and can it read or change what appears on those pages?
It reads every visible text node in the page body, not just a narrow page element.
A TreeWalker accepts non-hidden text nodes and concatenates each node's textContent into one string. — content.js:4-30
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
Visible messages, documents, and account text can be included, but input values, passwords, and hidden nodes are not specifically read.
The broad visible-text walk includes text from any visible page element while rejecting display:none, visibility:hidden, and empty nodes. — content.js:5-30
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence of this behavior was found in the reviewed package.
Requests activeTab and scripting only and declares no storage or browser-data permission. — manifest.json:7-25
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Declares none of the relevant permissions. — manifest.json:7-25
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
No evidence of this behavior was found in the reviewed package.
The text flows only through local word matching, sorting, random selection, and badge textContent; there is no network API or destination. — content.js:22-65
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Word rules and company suffixes are fixed in packaged source. — content.js:28-55
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Page scanning and badge insertion happen automatically on every eligible page load without a user action.
Automatically loads content.js on all URLs. — manifest.json:10-20
Immediately scans the page and appends a badge when at least two words exist. — content.js:4-65
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Requests no settings-related permission. — manifest.json:7-25
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Uses descriptive variables and step-by-step comments with no packing or concealment. — content.js:1-66
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Performs only DOM traversal, string operations, random selection, and DOM creation. — content.js:1-66
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The all-URLs match causes execution across browsing sites. — manifest.json:10-20
Does not reference location, URL, history, or persistence APIs. — content.js:1-66
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
Contains no network or storage code. — content.js:1-66
Does it send cookies, session details, authentication data, or page contents elsewhere?
No evidence of this behavior was found in the reviewed package.
Uses visible textContent only; document.cookie and authentication APIs are absent. — content.js:1-66
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Reads existing visible text nodes once and registers no keyboard, input, or form event listeners. — content.js:4-30
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
There is no network, messaging, or remote configuration channel. — content.js:1-66
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
Creates #company-badge, sets its textContent to the locally generated name, and appends it to document.body. — content.js:52-65
Displays the badge at the bottom-right with z-index 9999 and pointer events disabled. — styles.css:1-32
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No evidence of this behavior was found in the reviewed package.
Requests no network-interception, proxy, or download permission. — manifest.json:7-25
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging permission. — manifest.json:7-25
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All behavior and suffix choices are packaged locally. — content.js:1-66
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Declares no externally_connectable entry. — manifest.json:1-25
Registers no message listener. — content.js:1-66
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Hard-codes all-URLs execution. — manifest.json:10-20
Reads no settings and always runs when injected. — content.js:1-66
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Performs one linear DOM text walk and small local string operations. — content.js:4-65
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Reads text nodes and appends its own noninteractive span; no form or input APIs are used. — content.js:4-65